[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
memory overrun in xgps_cursor_mask
From: |
Willem Rein Oudshoorn |
Subject: |
memory overrun in xgps_cursor_mask |
Date: |
19 Nov 2001 21:15:08 +0100 |
User-agent: |
Gnus/5.09 (Gnus v5.9.0) Emacs/21.1 |
Setting a cursor whose width is a multiple 8
and containing an alpha component makes the method
xgps_cursor_mask crash.
The reason is that the the at the end of the inner
loop at an 8 boundary the pointer is incremented,
but is immediate after that also incremented by
the outer loop.
The following patch fixes this.
--------------[ ChangeLog & Diff ]--------------------------------
2001-11-19 Willem Rein Oudshoorn <woudshoo@xs4all.nl>
* xgps-devel/Source/SharedX/XGContextWindow.m ([XGContext
-GSAvailableDepthsForScreen:screen_num]):
removed unused local variable declaration.
(xgps_cursor_mask): fixed memory overrun.
Index: XGContextWindow.m
===================================================================
RCS file: /cvsroot/gnustep/gnustep/core/xgps/Source/SharedX/XGContextWindow.m,v
retrieving revision 1.78
diff -c -r1.78 XGContextWindow.m
*** XGContextWindow.m 2001/10/17 03:59:52 1.78
--- XGContextWindow.m 2001/11/19 20:01:55
***************
*** 2002,2019 ****
for (j = 0; j < h; j++)
{
k = 0;
! for (i = 0; i < w; i++)
{
! data += 3;
ialpha = (unsigned short)((char)*data++);
if (ialpha > ALPHA_THRESHOLD)
*cData |= (0x01 << k);
- k++;
- if (k > 7)
- {
- cData++;
- k = 0;
- }
}
cData++;
}
--- 2002,2018 ----
for (j = 0; j < h; j++)
{
k = 0;
! for (i = 0; i < w; i++, k++)
{
! if (k > 7)
! {
! cData++;
! k = 0;
! }
! data += 3;
ialpha = (unsigned short)((char)*data++);
if (ialpha > ALPHA_THRESHOLD)
*cData |= (0x01 << k);
}
cData++;
}
***************
*** 2277,2283 ****
{
Display *display;
Screen *screen;
- int bpp = 0;
int class = 0;
int index = 0;
int ndepths = 0;
--- 2276,2281 ----
- memory overrun in xgps_cursor_mask,
Willem Rein Oudshoorn <=